Crazy I was crazy once

Platform: Metactf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: leet_normalization, positional_token_extraction, reverse_concatenation

Summary

Task: a text file repeats the 'crazy? i was crazy once' rhyme with increasing leetspeak and symbol substitutions. Solution: extract the three-character token immediately before each repetition's final crazy!, concatenate the 20 fragments, then reverse the result to recover the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_crazy
• Tags: text_steganography, leet_speak, dawgctf, repeated_phrase, hidden_fragments, reversal
• Indicators: the same sentence is repeated many times with gradual character substitutions, each repetition still ends in a recognizable final crazy! token, the word immediately before the final crazy! is always a short fixed-length fragment, concatenated fragments look reversed or nonsensical until read backwards
• Source: 20260410_metactf_crazy.md

Foothold

Vulnerability / Misconfiguration

1. Leet_normalization
2. Positional_token_extraction
3. Reverse_concatenation

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• leet_normalization
• positional_token_extraction
• reverse_concatenation
• Tags: text_steganography, leet_speak, dawgctf, repeated_phrase, hidden_fragments, reversal

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Source challenge: Crazy I was crazy once

Provided file: crazy.txt

English summary: the challenge gives a single text file containing the same rhyme repeated many times. Each loop is slightly more corrupted with leetspeak, and the hidden flag is embedded in a consistent position inside every repetition.

Analysis

The important pattern is that every repetition ends with a final crazy! token before the next loop begins. The token immediately before that ending is always exactly three characters long and does not fit the surrounding sentence.

Extracting those 20 fragments yields:

}pl eh_ dne s_e sae lp_ efi l_y m_f o_l ort noc _ll a_t sol _ev ah_ i{F i{F waD

That string is clearly backwards. Reversing it reconstructs the full flag:

DawgCTF{REDACTED}

Solution

1. Read crazy.txt and split it into whitespace-separated tokens.
2. Normalize each token by translating common leetspeak substitutions (4 -> a, 3 -> e, 1 -> i, 0 -> o, 5 -> s, 7 -> t, @ -> a) and stripping punctuation except !.
3. Whenever the normalized token equals crazy!, record the raw token immediately before it.
4. Concatenate the 20 recorded three-character fragments.
5. Reverse the concatenated string to recover the flag.

#!/usr/bin/env python3

import re
from pathlib import Path

LEET = str.maketrans({
    "4": "a",
    "3": "e",
    "1": "i",
    "0": "o",
    "5": "s",
    "7": "t",
    "@": "a",
})


def normalize(token: str) -> str:
    cleaned = re.sub(r"^[^A-Za-z0-9@]+|[^A-Za-z0-9!?@]+$", "", token)
    return cleaned.translate(LEET).lower()


def main() -> None:
    data = Path("crazy.txt").read_text(encoding="utf-8")
    tokens = data.split()

    parts = []
    for i, token in enumerate(tokens):
        if normalize(token) == "crazy!" and i > 0:
            prev = re.sub(r"[^A-Za-z0-9_{}]", "", tokens[i - 1])
            if len(prev) == 3:
                parts.append(prev)

    encoded = "".join(parts)
    flag = encoded[::-1]

    print(f"parts ({len(parts)}):", parts)
    print("encoded:", encoded)
    print("flag:", flag)


if __name__ == "__main__":
    main()

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR